Full Report
Links between ATMZOW JS-sniffer and Hancitor
Analysis Summary
# Tool/Technique: ATMZOW JS-sniffer
## Overview
ATMZOW is a JavaScript (JS) sniffer designed to steal payment card data and sensitive information from e-commerce websites and phishing pages. It utilizes sophisticated obfuscation techniques and has been recently linked to phishing campaigns distributing the **Hancitor** (Chanitor) malware via the **Prometheus TDS** (Traffic Distribution System).
## Technical Details
- **Type:** Malware Family (JS-sniffer / Form Grabber)
- **Platform:** Web Browsers / E-commerce CMS
- **Capabilities:** Credential harvesting, payment card skimming, anti-analysis obfuscation, cross-domain data exfiltration.
- **First Seen:** Identified as a distinct cluster in recent years, with infrastructure links dating back to 2021 campaigns.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1189 - Drive-by Compromise
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores
- T1539 - Steal Web Session Cookie
- **TA0007 - Discovery**
- T1010 - Application Window Discovery
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **Form Grabbing:** Monitors input fields on checkout or login pages to capture credit card numbers, CVVs, expiration dates, and login credentials.
- **Obfuscation:** Uses a unique, heavy obfuscation layer (referred to as ATMZOW-like) to hide its logic from security scanners and manual inspection.
- **Data Exfiltration:** Sends captured data to attacker-controlled "gates" or storage domains.
### Advanced Features
- **IDN Spoofing:** Use of Internationalized Domain Names (IDN) or Punycode (e.g., `xn--...`) to spoof legitimate banking and financial domains.
- **Prometheus TDS Integration:** Leverages the Prometheus Traffic Distribution System to redirect users based on their profile (geo-location, browser, etc.) to either a malicious document (dropping Hancitor) or a phishing page containing the ATMZOW sniffer.
- **Google Tag Manager (GTM) Abuse:** Exploits GTM containers (e.g., `GTM-WNV8QFR`) to inject malicious scripts into target websites.
## Indicators of Compromise
### File Hashes
- **Malicious Doc (Hancitor loader):** `be3effcb9069ac6d66256c8246fde33e55980403` (SHA1)
- **Hancitor DLL:** `17693bca881ec9bc9851fcb022a664704c048b9d` (SHA1)
### Network Indicators (Defanged)
- **JS Sniffer Storage:** `designestylelab[.]com`
- **Exfiltration Gates:**
- `gvenlayer[.]com`
- `metahtmlhead[.]com`
- `winsiott[.]com`
- `congolo[.]pro`
- `vamberlo[.]com`
- `nmdatast[.]com`
- `seclib[.]org`
- **Phishing/Spoofed Domains:**
- `xn--kys-nvigatorky-zp8g5mna[.]com`
- `xn--keyvigatrs-key-7oc4531jsva[.]com`
- `xn--nvigators-key-if2g[.]com`
- `navlgator-kcy[.]com`
## Associated Threat Actors
- **MAN1 / Moskalvgapo:** Historically associated with Hancitor operations.
- **ATMZOW Operators:** The specific group managing the JS-sniffer cluster, now confirmed to be sharing infrastructure or operating in coordination with Hancitor distributors.
## Detection Methods
- **Signature-based:** Detection of the specific ATMZOW obfuscation pattern in `.js` files.
- **Behavioral:** Monitoring for unauthorized outbound POST requests from checkout pages to unknown third-party domains.
- **GTM Monitoring:** Auditing Google Tag Manager containers for unrecognized script injections or suspicious IDs like `GTM-WNV8QFR`.
## Mitigation Strategies
- **Content Security Policy (CSP):** Implement strict CSP headers to prevent scripts from loading from unauthorized domains and to restrict where data can be sent.
- **Subresource Integrity (SRI):** Use SRI hashes for third-party scripts to ensure they haven't been tampered with.
- **Punycode Alerts:** Enable browser or gateway alerts for IDN/Punycode domains that mimic legitimate brand names.
- **Macro Disabling:** Enforce policies to disable macros in Office documents received from external sources to prevent Hancitor infection.
## Related Tools/Techniques
- **Hancitor (Chanitor):** A downloader malware often used to deliver Ficker Stealer or Cobalt Strike.
- **Prometheus TDS:** A commercial traffic distributor used by various cybercriminals to filter and direct victims.
- **Magecart:** The broader umbrella of JS-sniffing techniques used against e-commerce platforms.